Closes #9

analysis/03-Two_Sum_Is_Not_About_Numbers/readme.md

@@ -275,18 +275,43 @@ At this point, the original Two Sum is almost unrecognizable.
 
 See example implementation:
 
-- examples/two_sum_logs_demo.cpp
+- examples/two_sum_logs_demo
 
 ---
 
 ## Example Output
 
-Interview-style reduction:
+```
-  combines events from different request_id → false positive
+Synthetic log stream:
+  2026-04-16T10:15:01.100Z service=api    event=parse_input   latency=12ms request_id=req-1001
+  2026-04-16T10:15:01.110Z service=cache  event=cache_miss    latency=48ms request_id=req-1001
+  2026-04-16T10:15:01.120Z service=auth   event=token_check   latency=58ms request_id=req-2001
+  2026-04-16T10:15:01.130Z service=db     event=read_user     latency=43ms request_id=req-3001
+  2026-04-16T10:15:01.135Z service=db     event=read_user     latency=55ms request_id=req-1001
+  2026-04-16T10:15:01.144Z service=net    event=external_call latency=47ms request_id=req-1001
+  2026-04-16T10:15:01.200Z service=cache  event=cache_miss    latency=60ms request_id=req-3001
+  2026-04-16T10:15:01.260Z service=net    event=external_call latency=52ms request_id=req-3001
 
-Streaming solution:
+Threshold: 100ms
-  finds valid pair within same request and time window
+Time window: 20ms
 
+Interview-style reduction (ignores request_id and time):
+  first : 2026-04-16T10:15:01.110Z service=cache  event=cache_miss    latency=48ms request_id=req-1001
+  second: 2026-04-16T10:15:01.120Z service=auth   event=token_check   latency=58ms request_id=req-2001
+  combined latency: 106ms
+
+Streaming sliding-window detection:
+  first : 2026-04-16T10:15:01.135Z service=db     event=read_user     latency=55ms request_id=req-1001
+  second: 2026-04-16T10:15:01.144Z service=net    event=external_call latency=47ms request_id=req-1001
+  combined latency: 102ms
+
+Notes:
+  - The interview-style version can produce a false correlation.
+  - In this dataset, it first matches 58ms from req-2001 with 43ms from req-3001.
+  - That pair exceeds the threshold, but it is operationally meaningless.
+  - The streaming version only correlates events from the same request_id
+    and only within the configured time window.
+```
 ---
 
 ## Explanation